Security issue: replace non-secure cryptography

[paulmillr]

You're using elliptic, which has long been unmaintained, and has a few cases where it produces invalid outputs, which means in blockchain context "users lose money".

It is advised to replace it with audited @noble/curves.

[paulmillr]

Do you guys still care about security?

Elliptic just had a vulnerability which leaked private keys from signatures GHSA-vjh7-7g9h-fjfh

[OttoAllmendinger]

thank you for pointing this out

#5577

[michaelchenchen]

This appears to have been resolved by PR #5577 which replaced elliptic with noble/secp256k1. All direct source code imports of elliptic have been migrated to @noble/curves. The elliptic dependency now only exists as a locked transitive dependency.

[exocognosis]

elliptic has been unmaintained for years and its invalid-output cases are real. In a custody SDK that is a funds-loss vector, not a hygiene issue. @noble/curves is the audited replacement. Happy to take a look at the relevant code if helpful.